I've been trying to disable mod_security sql injection rule by adding this to the conf file
SecRuleRemoveById 981172
SecRuleRemoveById 981243
SecRuleRemoveById 981173
SecRuleRemoveById 981249
SecRuleRemoveById 981318
SecRuleRemoveById 981246
SecRuleRemoveById 981231
But theres seem to be more rules, is there anyway i can disable the sql injection rule without adding each rules id? or am i going about this the wrong way.
The reason i want to disable this is because i am attempting to install IPS(forums) and everything i do, whether it's adding a user or editing a category i get a 403 error caused by mod security and the errors usually say that there was a pattern match in the post header or cookies.
Edit: Here is one of the errors
Message: Access denied with code 403 (phase 2). Pattern match "(/\\*!?|\\*/|[';]--|--[\\s\\r\\n\\v\\f]|(?:--[^-]*?-)|([^\\-&])#.*?[\\s\\r\\n\\v\\f]|;?\\x00)" at ARGS:core_theme_setting_title_167. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "49"] [id "981231"] [rev "2"] [msg "SQL Comment Sequence Detected."] [data "Matched Data: '#'>This found within ARGS:core_theme_setting_title_167: <h4>Mega Footer Links</h4>\x0d\x0a<ul class='footerLinks'>\x0d\x0a\x09<li><a href='http://www.ipsfocus.com'>IPS 4.x themes</a></li>\x0d\x0a\x09<li><a href='#'>This is a link list</a></li>\x0d\x0a\x09<li><a href='#'>This is a longer link inside of the list</a></li>\x0d\x0a\x09<li><a href='#'>This is a link list</a></li>\x0d\x0a</ul>"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.8"] [maturity "8"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]